All Apps and Add-ons

Splunk DB Connect: Why does table get locked for output

ankurborah
Path Finder

I am using Splunk DB connect app for SqlServer DB. The connection is working fine.
I am able to feed search result to DB table e.g xyz. I have a scheduler that executes every 2 minutes.
Now the problem is xyz table locked frequently and this table is accessed by another front-end application.

Is it possible that while Splunk is writing into DB table it gets locked for that duration or any other reason for table locking?

0 Karma

amitm05
Builder

@ankurborah
I believe this is not to be handeled by Splunk but rather by your SQL query statements itself. Because splunk isn't doing anything about locking your table.
Suggestions -
Do you require such high frequency of querying your table for writing. See if you can reduce the cron for this.
Use Transactions in your Sql qyery to avoid lockouts. An example - https://blog.cloudboost.io/how-to-use-transaction-in-sql-server-aaaaa23e491a

Hope this helps. Let me know.
Thanks

0 Karma

ankurborah
Path Finder

Thanks for reply. I am using Splunk DB Connect > Data Lab > Outputs to write Splunk query results to DB table. We have DB team they mentioned that table is get locked after we develop the splunk solution to write into DB. Application that accessing the DB table is using get methods(read only) so they need the table should be unlock status always.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

 Prepare to elevate your security operations with the powerful upgrade to Splunk Enterprise Security 8.x! This ...

Get Early Access to AI Playbook Authoring: Apply for the Alpha Private Preview ...

Passionate about security automation? Apply now to our AI Playbook Authoring Alpha private preview ...

Reduce and Transform Your Firewall Data with Splunk Data Management

Managing high-volume firewall data has always been a challenge. Noisy events and verbose traffic logs often ...